On Thu, 11 Jan 2024 at 06:15, <gua....@intel.com> wrote:
>
> From: Gerd Hoffmann <kra...@redhat.com>
>
> REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4166
>
> Fix integer overflow in various CreateHob instances.
> Fixes: CVE-2022-36765
>
> The CreateHob() function aligns the requested size to 8
> performing the following operation:
> ```
> HobLength = (UINT16)((HobLength + 0x7) & (~0x7));
> ```
>
> No checks are performed to ensure this value doesn't
> overflow, and could lead to CreateHob() returning a smaller
> HOB than requested, which could lead to OOB HOB accesses.
>
> Reported-by: Marc Beatove <mbeat...@google.com>
> Cc: Leif Lindholm <quic_llind...@quicinc.com>
> Cc: Ard Biesheuvel <ardb+tianoc...@kernel.org>
> Cc: Abner Chang <abner.ch...@amd.com>
> Cc: John Mathew <john.math...@intel.com>
> Signed-off-by: Gerd Hoffmann <kra...@redhat.com>
This is missing a signed-off line from the sender.
(the signoff is not a statement of authorship, it is a promise by the
sender that the contribution complies with the license)
With that fixed:
Reviewed-by: Ard Biesheuvel <a...@kernel.org>
> ---
> EmbeddedPkg/Library/PrePiHobLib/Hob.c | 6 ++++++
> 1 file changed, 6 insertions(+)
>
> diff --git a/EmbeddedPkg/Library/PrePiHobLib/Hob.c
> b/EmbeddedPkg/Library/PrePiHobLib/Hob.c
> index 8eb175aa96..ee2e3176be 100644
> --- a/EmbeddedPkg/Library/PrePiHobLib/Hob.c
> +++ b/EmbeddedPkg/Library/PrePiHobLib/Hob.c
> @@ -110,6 +110,12 @@ CreateHob (
>
> HandOffHob = GetHobList ();
>
> + //
> + // Check Length to avoid data overflow.
> + //
> + if (HobLength > MAX_UINT16 - 0x7) {
> + return NULL;
> + }
> HobLength = (UINT16)((HobLength + 0x7) & (~0x7));
>
> FreeMemory = HandOffHob->EfiFreeMemoryTop -
> HandOffHob->EfiFreeMemoryBottom;
> --
> 2.39.2.windows.1
>
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#113584): https://edk2.groups.io/g/devel/message/113584
Mute This Topic: https://groups.io/mt/103657273/21656
Group Owner: devel+ow...@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-
